Commit Graph

3555 Commits

Author SHA1 Message Date
Siyuan Zhang 7f5df11548 add emulated-version flag to kube-scheduler to control the feature gate.
Signed-off-by: Siyuan Zhang <sizhang@google.com>

Kubernetes-commit: 40cddbe21516122a528e2afb2b1fbcaed1acbe8a
2024-06-27 11:56:49 -07:00
Matthieu MOREL 8705baa8b2 fix: enable empty and len rules from testifylint on pkg package
Signed-off-by: Matthieu MOREL <matthieu.morel35@gmail.com>

Co-authored-by: Patrick Ohly <patrick.ohly@intel.com>

Kubernetes-commit: f014b754fb5925dfbca6e27a44d0c3968b157e14
2024-06-28 21:20:13 +02:00
Vinayak Goyal fd1f3aafaf Fix typo in error message for anonymous field in AuthenticationConfiguration.
Kubernetes-commit: 27e8923c70c8bf95e0db02aeb7a0d45908ae9d62
2024-07-09 21:04:28 +00:00
Abu Kashem 5f6927c810 add test to document request timeout behavior
- using the default handler chain of the kube-apiserver

Kubernetes-commit: c6210ff8ab4a94d1dd31a56acc16dc9fdc2333f4
2024-05-07 13:52:18 -04:00
Siyuan Zhang 6f7147fc9d fix lock bug for componentGlobalsRegistry
Signed-off-by: Siyuan Zhang <sizhang@google.com>

Kubernetes-commit: d31aebe57224b678a0c17df7766d8e7f850209e8
2024-07-05 15:50:10 +00:00
Davanum Srinivas 1292729d42 Fix for typecheck doesn't notice compile errors in test files
- ensure we add all the staging modules so the _test files in there are "loaded"
- use build tags to skip tests that fail to build in specific os/arch pairs

Signed-off-by: Davanum Srinivas <davanum@gmail.com>
Co-Authored-By: Tim Hockin <thockin@google.com>

Kubernetes-commit: c230a45383c372e3861de3d4854cdfe28f4c482f
2024-07-02 16:26:41 -04:00
Joe Betz b754d6e7f2 Remove special case logic in apiserver to serve all APIs when binary version is set artifically to 0.0
Kubernetes-commit: 1864e7131eca32fc9bebf20641becb467f240eca
2024-07-03 14:16:15 -04:00
Abu Kashem f553925235 apiserver: remove feature gate APIPriorityAndFairness
Kubernetes-commit: ae647032a74bf8f671fa8db0602dee301cf865bf
2024-07-02 12:55:43 -04:00
Eric Lin 5d14d72b5c Fix httplog not logging watch duration in separate goroutines
Signed-off-by: Eric Lin <exlin@google.com>

Kubernetes-commit: 06c7058115e623126884d05c54a30db511a9cb71
2024-06-21 10:03:31 +00:00
Wojciech Tyczyński a643e14347 Implement resilient watchcache initialization post-start-hook
Kubernetes-commit: a5772bd42593f6492f5169eef49bc9884f95abba
2024-06-13 11:02:18 +02:00
Lukasz Szaszkiewicz 8321755755 kube-apiserver: promote WatchList feature to beta
Kubernetes-commit: 0b15903b35d83ca32833e81997b6257ee4d4f369
2024-06-19 11:48:20 +02:00
Vinayak Goyal 77f498853b KEP-4633: Allow health-only anonymous auth mode.
Signed-off-by: Vinayak Goyal <vinaygo@google.com>

Kubernetes-commit: 5e6a4937f5a3e20dd77238946220461332ecddff
2024-05-16 21:18:34 +00:00
Lukasz Szaszkiewicz 5e71b4e71d apiserver/storage/watchcache: WaitUntilFreshAndList supports path prefix
Kubernetes-commit: 2f9660db6b0ba37ff383559b1b0324c635f1eb66
2024-06-26 14:34:32 +02:00
Lukasz Szaszkiewicz bc659f87fc flowcontrol/request/list_work_estimator: sync shouldDelegateList
Kubernetes-commit: c259fe2342162a0c883845bfbdf8a838697fe085
2024-06-17 16:14:39 +02:00
Lukasz Szaszkiewicz 54645c663b apiserver/storage/cacher: cache supports pagination
Kubernetes-commit: 09e85983d84b5f6c3fed6c09dd0adcbdde7e9d5f
2024-06-10 10:14:38 +02:00
Lukasz Szaszkiewicz f0e44d48b8 apiserver/storage: storagetesting.RunTestList validates RemainingItemCount
Kubernetes-commit: f9b15700fb5a99ab74d51c7779ea2aae0f51168c
2024-06-27 11:01:37 +02:00
Lukasz Szaszkiewicz 9afcce8b2b storage/cacher/cacher_whitebox_test.go: deflake TestWaitUntilFreshAndListFromCache
Kubernetes-commit: 662672a6cacd71ad0cfc168a793d6a75a7e0ffff
2024-06-26 15:04:15 +02:00
Wojciech Tyczyński 58b911dc71 Fix test flakes for TestWatchSemantics
Kubernetes-commit: 5081ba45f9ed84784a250338ee6d96b485ff4e4a
2024-06-26 17:49:54 +02:00
yintong.huang 5a2cafd6ec drop deprecated PollWithContext and adopt PollUntilContextTimeout instead
Signed-off-by: yintong.huang <yintong.huang@daocloud.io>

Kubernetes-commit: 2db1b321e0edf9e3c4e434353d505cec96bfb319
2024-06-21 19:23:31 +08:00
Lukasz Szaszkiewicz 4500696478 apiserver/storage: decrease running time of RunWatchSemantics
Kubernetes-commit: c6ef512b5bb15aa3c2430ae03dad91e16a342bce
2024-06-26 10:49:20 +02:00
Marek Siarkowicz 6c1033e89d Remove 5 seconds from TestWatchStreamSeparation execution by reusing etcdserver
Kubernetes-commit: 1c111c603e1962b4bfd5aae40d8a5ecc0e3ad9d5
2024-06-26 11:32:57 +02:00
Paco Xu 1c9c46740e Revert "apiserver/storage/cacher: consistent read from cache supports limit"
Kubernetes-commit: df17ea2e37d1b36dcda10fe20de5484c41c615b5
2024-06-26 11:51:12 +08:00
Siyuan Zhang b26fefe178 add DefaultComponentGlobalsRegistry flags in ServerRunOptions
Signed-off-by: Siyuan Zhang <sizhang@google.com>

Kubernetes-commit: 379676c4bef48e5d2add28851302b55b41fcabcf
2024-06-10 17:50:22 +00:00
Siyuan Zhang 00857ca9ec Add version mapping in ComponentGlobalsRegistry.
Signed-off-by: Siyuan Zhang <sizhang@google.com>

Kubernetes-commit: 4352c4ad2762ce49ce30e62381f8ceb24723fbcc
2024-05-31 20:29:48 -07:00
Siyuan Zhang c80af88d21 Add composition flags for emulation version and feature gate.
Signed-off-by: Siyuan Zhang <sizhang@google.com>

Kubernetes-commit: 701e5fc3744c2b21ba5b1ca3399b71c9becf06d0
2024-05-30 12:08:52 -07:00
Siyuan Zhang 22612a3528 apiserver: Add API emulation versioning.
Co-authored-by: Siyuan Zhang <sizhang@google.com>
Co-authored-by: Joe Betz <jpbetz@google.com>
Co-authored-by: Alex Zielenski <zielenski@google.com>

Signed-off-by: Siyuan Zhang <sizhang@google.com>

Kubernetes-commit: 403301bfdf2c7312591077827abd2e72f445a53a
2024-01-19 16:07:00 -08:00
Davanum Srinivas 11d0eb6174 drop OWNERS in kubeadm
Signed-off-by: Davanum Srinivas <davanum@gmail.com>

Kubernetes-commit: 16e24513b76f66bfa47a93291ec52a2fcd1e11c0
2024-06-25 06:36:05 -04:00
Davanum Srinivas cca712b8b8 Add sig/etcd labels for related directories
Signed-off-by: Davanum Srinivas <davanum@gmail.com>

Kubernetes-commit: 1390ac0e250da4697b706c68cbb955268e27037d
2024-06-24 17:03:34 -04:00
Lukasz Szaszkiewicz 2aadb1cb38 cacher: returns an error when watch list was requested and storage.RequestWatchProgress is disabled
Kubernetes-commit: cb8cbc60a15dd340ea834974355bd2f03453727c
2024-06-17 15:29:59 +02:00
Joe Betz b5d1135b94 Apply feedback
Kubernetes-commit: 13f809478f9322341a04715cda1b3912a9e470d5
2024-06-03 14:59:31 -04:00
Joe Betz dfdf159360 Handle unstructured objects correctly in IgnoreManagedFieldsTimestampsTransformer
Kubernetes-commit: c942ab6900ddb7b6e3e7c550c521409693180968
2024-05-31 21:25:25 -04:00
Lukasz Szaszkiewicz 1e440f380b flowcontrol/request/list_work_estimator: sync shouldDelegateList
Kubernetes-commit: a7b1a9bb267cd721e673ae8352f068b4bc0b2f05
2024-06-17 16:14:39 +02:00
Lukasz Szaszkiewicz 062ed2e6c0 apiserver/storage/cacher: cache supports pagination
Kubernetes-commit: 87536f367dd67b4fd9b1c7ee31189896921f2f9e
2024-06-10 10:14:38 +02:00
Joe Betz 30fd718497 Fix apply equality check to allow empty map to be equal to nil for builtin types
Kubernetes-commit: f8a33e3679488e5ee3700d37dd45cee8b346e89e
2024-06-04 12:11:00 -04:00
Marek Siarkowicz ddbe9fe28a Move ConsistentListFromCache to Beta default
Kubernetes-commit: 0c0e19b343d48d4bea0e7fa735e3781c70298a34
2024-02-26 14:34:53 +01:00
Marek Siarkowicz 22c2235078 Explicitly disable ConsistentListFromCache in TestGetListNonRecursiveCacheBypass
Kubernetes-commit: 4e51e9cff8f48a38bb5ce45e8602842486c3a59e
2024-02-26 16:43:24 +01:00
Lukasz Szaszkiewicz 2ac45c2a57 storage/cacher/cacher_whitebox_test.go: deflake tests that require storage.RequestWatchProgress
Kubernetes-commit: 47a61f03d4fad96fb40f4c1c6857061ee68b7ca5
2024-06-17 16:54:44 +02:00
Marek Siarkowicz 2abbfffe9a Fix TestGetListRecursivePrefix for all types of LIST
Kubernetes-commit: c207f967ac3122d3a2a5ae4befdc5ada22347323
2024-06-19 10:31:37 +02:00
xyz-li e5e53b7acc apiserver: fix watch namespace
For request like '/api/v1/watch/namespaces/*', don't set scope.namespace.
Because the func `addWatcher` add a watcher to allWatchers with the value `scope.namespace` not empty.
But the function `dispatchEvent` dispatch event with an empty namespace.

Signed-off-by: xyz-li <hui0787411@163.com>

Kubernetes-commit: 818fabe37b3fd7cebe36a43244120388977373cd
2024-05-27 17:48:49 +08:00
Lukasz Szaszkiewicz 253c97b2e8 apiserver/storage: factor PrepareContinueToken to a new function (#125548)
* apiserver/storage/continue: intro PrepareContinueToken

PrepareContinueToken prepares optional
parameters for retrieving additional results for a paginated request.

This function sets up parameters that a client can use to fetch the remaining results
from the server if they are available.

* apiserver/storage/etcd3: refactor to use PrepareContinueToken

Kubernetes-commit: efef32652af0af08a0b9c9bc547a4dce4a95f9f5
2024-06-17 18:23:23 +00:00
Mauri de Souza Meneguzzo 48995fc82a Fix flaking TestStoreListResourceVersion
Kubernetes-commit: e59988d769a87ec3efb12af0f9909f7549eecf05
2024-06-11 23:12:23 -03:00
TommyStarK 2c2eb3836c kube-apiserver: remove deprecated otel NewNoopTracerProvider
Signed-off-by: TommyStarK <thomasmilox@gmail.com>

Kubernetes-commit: cce8551272de44882a3cd4fc7c06805247941086
2024-06-07 19:57:37 +02:00
Wojciech Tyczyński 147e65f573 Reduce lock contention by using reader lock in watchcache interval
Kubernetes-commit: 6f0a400a1a7bb7d77d13181a91654f77f612c856
2024-06-11 12:20:57 +02:00
Marek Siarkowicz a8b9f862fb Add tests for how recursive parameter works with object prefixes
Kubernetes-commit: faa6193f34f7dac775328fbacb2f957370482024
2024-06-11 14:29:51 +02:00
Wojciech Tyczyński 794b1d5ff6 Expose resource version metrics from watchcache
Kubernetes-commit: dbed4f12107c549d8bb9efab105162d32316ce01
2024-06-07 09:39:23 +02:00
Wojciech Tyczyński 5a0e942d09 Implement ResilientWatchCacheInitialization
Kubernetes-commit: a8ef6e9f0104a44023162bb8229fb677ec80beb1
2024-04-29 14:19:46 +02:00
Eric Lin 9cab6e4eee cacher: apply key for initial events
For case of SendInitialEvents, a buffer of objects is created. That
process takes a significant amount of memory and CPU when the resource
is of a large volume. Many objects may be not relevant when key is provided.
This commit applies key when composing the buffer for SendInitialEvents.

Signed-off-by: Eric Lin <exlin@google.com>

Kubernetes-commit: d9c6c8aa5047d724e0ebc8907f5fee4b10012ae3
2024-05-04 10:46:02 +00:00
Lukasz Szaszkiewicz 175dd7c904 cacher: dispatchEvents is synced to watchCache.listResourceVersion
The internal informer populates the RV as soon as it conducts
The first successful sync with the underlying store.
The cache must wait until this first sync is completed to be deemed ready.
Since we cannot send a bookmark when the lastProcessedResourceVersion is 0,
we poll aggressively for the first list RV before entering the dispatch loop.

Kubernetes-commit: a20abdb1f425b215ce969ef7114281741fce249d
2024-06-03 10:26:50 +02:00
Harish Kuna eecd18b483 Annotate APF Wait Queue Latnecyto understand at the request level
Kubernetes-commit: 9a0d922a296e837b344d5538c0829d9e222c2ef6
2024-03-13 21:54:59 +00:00
Eric Lin f59dd2d95e Add /readyz for kube-scheduler
/readyz contains `sched-handler-sync`, `leaderElection` (when election is
enabled) and `shutdown` checks

Kubernetes-commit: 44c08fdbd592b7c167ad0c3b0b4a3b52b99c116f
2023-05-20 16:38:21 +00:00
Stephen Kitt 942c16fb6a Use canonical json-patch v4 import
The canonical import for json-patch v4 is
gopkg.in/evanphx/json-patch.v4 (see
https://github.com/evanphx/json-patch/blob/master/README.md#get-it for
reference).

Using the v4-specific path should also reduce the risk of unwanted v5
upgrade attempts, because they won't be offered as automated upgrades
by dependency upgrade management tools, and they won't happen through
indirect dependencies (see
https://github.com/kubernetes/kubernetes/pull/120327 for context).

Signed-off-by: Stephen Kitt <skitt@redhat.com>

Kubernetes-commit: 5300466a5c8988b479a151ceb77f49dd00065c83
2024-02-16 13:57:24 +01:00
Marek Siarkowicz 2c4a9730b5 Reset timer to zero when no progress notify was sent
Kubernetes-commit: 98e384fcd093d3cff4767ee009f8164b83bd4753
2024-05-24 11:07:01 +02:00
Marek Siarkowicz 6fb09e7027 Use normal Mutex instead of RWMutex
There is no benefit of having RWMutex as we have one reader and multiple
writers. In such cases RWMutex has worse performance than Mutex.

Kubernetes-commit: 544ea424826ef60d703c5f4fb91b2c6a95f303aa
2024-05-24 10:16:48 +02:00
Marek Siarkowicz 9af63b1bc9 Don't signal when lowering number of waiting routines
Signal is not needed as we never need to wake up when the waiting
is lowered, only when increased.

Kubernetes-commit: e6b54149bb42d58301e34872ebbcf2ea4bcfb474
2024-05-24 10:13:52 +02:00
Marek Siarkowicz be4e4c6bdd Use timer instead of ticker in progress requestor
Ticker behaves differently from what we want, we need a stable period
interval, but ticker doesn't provide that. From NewTicker docstring:
```
The ticker will adjust the time interval or drop ticks to make up for slow receivers.
```

Unfortunatelly there is no way to test it as the FakeClock doesn't
follow the real ticker behavior.

Kubernetes-commit: 7c0e9cda461e176959866b9c2d03b00e817e9b76
2024-05-24 10:10:27 +02:00
Jeremy Shih feabdb6d52 make test parallel in for loop
Kubernetes-commit: 40a25463fa48ee49a713b80b2157c362438960e2
2024-03-25 09:39:01 +08:00
Cici Huang 73c903e9cd Update cel env to 1.30
Kubernetes-commit: 6980cda87d548824a7cf33260096357ab3764bbe
2024-05-09 15:39:30 -07:00
Wojciech Tyczyński 34333a8e98 Reduce critical section for watchcache.lock
Kubernetes-commit: 202b4ffdf0cff90b5954d3442a1cdf7f2517cb2d
2024-05-21 13:58:35 +02:00
Monis Khan b0c3a41fa5 encryptionconfig: detect typos
Signed-off-by: Monis Khan <mok@microsoft.com>

Kubernetes-commit: 2503fa55ff13e3211e9f17fa97f70f9a67f3f6fc
2024-05-16 12:38:42 -04:00
Lukasz Szaszkiewicz 438190132c storage/cacher: waitUntilWatchCacheFreshAndForceAllEvents checks if storage.RequestWatchProgress is supported
Kubernetes-commit: 2db69ae1cd0073da97a0efdacf5df0ad42abce4c
2024-05-14 12:53:43 +02:00
Lukasz Szaszkiewicz 0750099ebf storage/cacher: dispatchEvents use progressRequester
Kubernetes-commit: 33f81ee23fc3f48d2f3aee85661944792c117694
2024-05-08 15:43:23 +02:00
Mangirdas Judeikis 65ef30865d move to generics for sets in kubeapiserver
Kubernetes-commit: b14936f6795028b1d8dd9f6a4cb0361b4c7bb9bc
2024-05-12 11:49:42 +03:00
Cici Huang d44012e895 Adding the feature gates to fix cost for VAP and webhook matchConditions.
Kubernetes-commit: d6e4115ead6b93d2accf688876471231b365ceae
2024-05-01 16:26:41 -07:00
ah8ad3 8137baec35 Feat: warn user if etcd version is not supported for RequestWatchProgress
Kubernetes-commit: 9f8273a5c5d6d087c0839145616c828ab9a62f60
2024-04-29 15:56:35 +03:30
Jayapriya Pai c05e83dd40 Expose DisableHTTP2 flag in SecureServingOptions
This is to mitigate CVE-2023-44487
until the Go standard library and golang.org/x/net
are fully fixed.

Signed-off-by: Jayapriya Pai <janantha@redhat.com>

Kubernetes-commit: e2503e50381cc9cc2e4a4c90f0738e54992558f8
2023-12-05 11:41:58 +05:30
Alvaro Aleman da88853b95 Use the generic/typed workqueue throughout
This change makes us use the generic workqueue throughout the project in
order to improve type safety and readability of the code.

Kubernetes-commit: 6d0ac8c561a7ac66c21e4ee7bd1976c2ecedbf32
2024-04-28 18:26:18 +02:00
Joe Betz e721afc903 Promote RetryGenerateName to beta
Kubernetes-commit: 1b59f3678fa95cb6bf647e349dd8ba023914eff0
2024-05-01 20:34:21 -04:00
Taehoon Yoon f01be2e04b Updated & added visibility to apiserver x509 test certificates expiring this year
Kubernetes-commit: 12795107a1685d3701425db9119546b3b77b6e19
2024-05-02 23:22:55 +00:00
Anish Ramasekar 2f368abc9f Remove unused NewSecure function in requestheader.go
Signed-off-by: Anish Ramasekar <anish.ramasekar@gmail.com>

Kubernetes-commit: 699d1f1b7a14fea4d97c41854b6428e0b6313c2c
2024-04-29 11:19:54 -07:00
Andrew DeMaria 7d59581b90 apiserver/options: avoid segfault by handling unset core k8s client
Fixes: https://github.com/kubernetes/apiserver/issues/108
Signed-off-by: Andrew DeMaria <ademaria@cloudflare.com>

Kubernetes-commit: b2d1aef1e3800c73e266131e585069eb3b177591
2024-04-22 12:50:23 -06:00
cyclinder eca9e91401 Fix data race in apiserver mux handler
Signed-off-by: cyclinder <kuocyclinder@gmail.com>

Kubernetes-commit: 6a194182a141665cfcb9b03815d77cd1e468d34e
2024-02-20 14:34:22 +08:00
Wojciech Tyczyński fd60fafe9c Deflake watchcache tests
Kubernetes-commit: 6d9edcc694415d4c1a897c4312ecd872a7f0fbf3
2024-04-29 14:26:25 +02:00
Patrick Ohly 5ea67c789a apiserver + controllers: enhance context support
27a68aee3a4834 introduced context support for events. Creating an event
broadcaster with context makes tests more resilient against leaking goroutines
when that context gets canceled at the end of a test and enables per-test
output via ktesting.

The context could get passed to the constructor. A cleaner solution is to
enhance context support for the apiserver and then pass the context into the
controller's run method. This ripples up the call stack to all places which
start an apiserver.

Kubernetes-commit: b92273a760503cc57aba37c4d3a28554f7fec7f8
2023-12-01 09:00:59 +01:00
liyuerich d8646c593d drop deprecated workqueue NewNamed package
Signed-off-by: liyuerich <yue.li@daocloud.io>

Kubernetes-commit: 98dfaed4bec33b4995572685eb084d8202ac235b
2023-10-16 18:11:17 +08:00
ah8ad3 2b7a0cfef8 Add FeatureSupportChecker for etcd storage
Kubernetes-commit: 70e65eee46cbf72efabe8440a92117d1fedf6497
2024-04-23 16:58:01 +03:30
Marek Siarkowicz 74fb076497 Cleanup defer from SetFeatureGateDuringTest function call
Kubernetes-commit: 3ee81787685e47a7a5da22423c8ca4455577ecb3
2024-04-23 10:39:47 +02:00
Marek Siarkowicz 5571570302 Remove workarounds for https://github.com/etcd-io/etcd/issues/17507
Kubernetes-commit: a08d1b5f3286c6f3698abf59022055dc0b4b922f
2024-04-23 12:27:03 +02:00
Marek Siarkowicz 0e8e550153 Upgrade etcd libraries to v3.5.13
Add otelgrpc.WithMessageEvents(otelgrpc.ReceivedEvents, otelgrpc.SentEvents) to tracing options due to https://github.com/open-telemetry/opentelemetry-go-contrib/pull/3964

Kubernetes-commit: 3e5b03eb433ee359782f5aa6e9368ab2a0d0370c
2024-04-23 11:10:37 +02:00
Alexander Zielenski 1412222ded feature: add name formats library to CEL
Kubernetes-commit: 0ed65fca7a2e5fc643102952b5361fdeeedde4b5
2024-02-28 18:04:33 -08:00
Alexander Zielenski 26d34beacd test: typecheck cel test cases
Kubernetes-commit: 11a6edfc887f3bc983165d19b05fca566ed82ba7
2024-04-19 13:52:22 -07:00
Jiahui Feng 63c6cc2b91 add trivial FindStructFieldNames to TypeProvider.
Kubernetes-commit: 73d67d86132702795685bf43f47ad167c0108b5a
2024-04-15 14:02:36 -07:00
Jiahui Feng 6f6178ef97 refit cost estimator with ast.Expr
Kubernetes-commit: ac5391fa21fc80559f70b72c42e64d3fa7569a42
2024-04-15 13:50:04 -07:00
Lukasz Szaszkiewicz dcdc23d1b3 apiserver/storage/cacher: decrease running time of TestCacheWatcherDrainingNoBookmarkAfterResourceVersionReceived
before:
go test -v -race -count 1 -run ^TestCacheWatcherDrainingNoBookmarkAfterResourceVersionReceived$
ok  	k8s.io/apiserver/pkg/storage/cacher	3.792s

after:
go test -v -race -count 1 -run ^TestCacheWatcherDrainingNoBookmarkAfterResourceVersionReceived$
ok  	k8s.io/apiserver/pkg/storage/cacher	1.783s

Kubernetes-commit: d21b86d53a3c4c42e41f8374e537c721251a00d2
2024-03-14 10:44:51 +01:00
chenk008 f687e45ec2 prioritize user EtcdOptions.StorageConfig.StorageObjectCountTracker
Kubernetes-commit: 587ce02d90f3c1e1bb7418753009baf63f6039b7
2024-04-18 23:02:16 +08:00
chenk008 70fb342c48 Fix: StorageObjectCountTracker is nil, apf estimator got ObjectCountNotFoundErr
Kubernetes-commit: 4abc2b387b188d694e369e05c08effce9d23e7e7
2024-04-08 11:09:27 +08:00
Sean Sullivan d4a69afe4c Adds apiserver proxy doc.go
Kubernetes-commit: 98ecfd0468c8f05bb49ddade1b71eb9683bdc1a2
2024-04-09 17:56:46 +00:00
Flavian Missi 20894ccdfa resourcequota: use singleflight.Group to reduce apiserver load
relates to #22422 and #123806

Kubernetes-commit: e13ff5ece2691988503d183b495cc7c39e899647
2024-04-03 09:58:27 +02:00
Abhishek Kr Srivastav 1d434b32e1 Added locks when accessing dummyStorage to prevent data race
Removed redundant locks

Removed locks and used existing func

Kubernetes-commit: eb5d2ca9d8efd6dcbbea582920c700ae86db4132
2024-03-20 14:23:33 +05:30
Wojciech Tyczyński b1a1768456 Relax WatchSemanticsTest to make it faster
Kubernetes-commit: a26ee123952eeb86467e61ff2eb744c9e736a045
2024-03-19 20:23:56 +01:00
David Eads 8c4fa4e478 Remove k8s.io/apiserver ability to bind insecure ports
The project does not recommend using insecure ports.  Even
unauthenticated TLS is an improvement since it provides confidentiality.
If you relied upon this, please update to secure serving options.

Kubernetes-commit: de302c73e9558c192fde1cd7d6dcbea7eb76e950
2024-03-18 09:25:49 -04:00
Lukasz Szaszkiewicz 9bfd27dc1c apiserver/storage: use metav1.InitialEventsAnnotationKey const
Kubernetes-commit: ed2b92c3dfb7d56155021824f0d9a61609dac051
2024-03-11 11:40:21 +01:00
Lukasz Szaszkiewicz d4f6eff589 apiserver/pkg/storage/utils: remove unused EverythingFunc
since we don't provide compatibility guarantees for the storage
package it is okay to simply remove unused function.

Kubernetes-commit: a40f25f8e6516d1a59169cf88db8b3850a8c48c7
2024-03-11 11:47:02 +01:00
Patrick Ohly 561da9109f cel: fix conversion of quantity to quantity
The code in ConvertToType checked for conversion into typeValue (=
"kubernetes.URL") instead of conversion into quantityTypeValue (=
"kubernetes.Quantity") and thus most likely failed with an incorrect "type
conversion error".

Kubernetes-commit: 02b4e99c9f0afa4ef9fa0283670c1515e40a5278
2024-03-04 12:23:54 +01:00
Ziqi Zhao 39347989da fix for comments to ignore the request without request info
Signed-off-by: Ziqi Zhao <zhaoziqi9146@gmail.com>

Kubernetes-commit: 91af1145bf7b0e18a6b520a78875a1db6db29d96
2024-03-15 09:42:42 +08:00
Ziqi Zhao 54b3a0e7f5 add http method to span name
Signed-off-by: Ziqi Zhao <zhaoziqi9146@gmail.com>

Kubernetes-commit: 1aeb0ba314016f2a2cd94b0450ba097c2b165e5d
2024-03-13 13:25:36 +08:00
Ziqi Zhao 29913c19e4 change the integration test
Signed-off-by: Ziqi Zhao <zhaoziqi9146@gmail.com>

Kubernetes-commit: 02154293c76a0ea54293c82236c9025b96ea0125
2024-03-12 22:49:38 +08:00
Ziqi Zhao 68eb5caed4 rename apiserver trace span to http server guidelines
Signed-off-by: Ziqi Zhao <zhaoziqi9146@gmail.com>

Kubernetes-commit: 84b9fbbdefa3f0bcfb1c4787093aa7840079b7ce
2024-02-29 19:03:43 +08:00
Patrick Ohly d712a4ee7e apimachinery runtime: support contextual logging
In contrast to the original HandleError and HandleCrash, the new
HandleErrorWithContext and HandleCrashWithContext functions properly do contextual
logging, so if a problem occurs while e.g. dealing with a certain request and
WithValues was used for that request, then the error log entry will also
contain information about it.

The output changes from unstructured to structured, which might be a breaking
change for users who grep for panics. Care was taken to format panics
as similar as possible to the original output.

For errors, a message string gets added. There was none before, which made it
impossible to find all error output coming from HandleError.

Keeping HandleError and HandleCrash around without deprecating while changing
the signature of callbacks is a compromise between not breaking existing code
and not adding too many special cases that need to be supported. There is some
code which uses PanicHandlers or ErrorHandlers, but less than code that uses
the Handle* calls.

In Kubernetes, we want to replace the calls. logcheck warns about them in code
which is supposed to be contextual. The steps towards that are:
- add TODO remarks as reminder (this commit)
- locally remove " TODO(pohly): " to enable the check with `//logcheck:context`,
  merge fixes for linter warnings
- once there are none, remove the TODO to enable the check permanently

Kubernetes-commit: 5a130d2b71e5d70cfff15087f4d521c6b68fb01e
2023-11-20 20:25:00 +01:00
Andrew DeMaria 81abb60d67 generate fully qualified type references
Currently type references for non-local names are output as relative
types which is subject to the resolution rules as defined at
https://protobuf.com/docs/language-spec#reference-resolution
This works fine within the k8s.io namespace where no subpackages are
named k8s, but other users of go-to-protobuf likely have k8s in their
package name. This causes conflicts in the search resolution when
executing `go-to-protobuf`:

```
company.example.com/k8s/custom/pkg/apis/custom.k8s.example.com/v1/generated.proto:64:12: "k8s.io.apimachinery.pkg.apis.meta.v1.ListMeta" is resolved to "company.example.com.k8s.custom.pkg.apis.custom.k8s.io.apimachinery.pkg.apis.meta.v1.ListMeta", which is not defined. The innermost scope is searched first in name resolution. Consider using a leading '.'(i.e., ".k8s.io.apimachinery.pkg.apis.meta.v1.ListMeta") to start from the outermost scope.
```

To avoid this we can output fully qualified type references using a
preceding dot (.)

This results in a change for k8s generated.proto files, but the
effect is a noop.

Fixes kubernetes/code-generator#147

Signed-off-by: Andrew DeMaria <ademaria@cloudflare.com>

Kubernetes-commit: 9edf1fc51c56d565348c48f3765cf094518ba7ed
2023-03-20 18:02:14 -06:00
Davanum Srinivas a22f7973bf Rename `cluster` to `storage_cluster_id` for apiserver_storage_size_bytes metric
Signed-off-by: Davanum Srinivas <davanum@gmail.com>

Kubernetes-commit: fb5140f562289f3ffe596b4a3af4650b850a0941
2024-04-11 15:06:03 -04:00
Marek Siarkowicz 7a3a726271 Undo double run of the TestWatchSemantics test to avoid hitting timeout
Kubernetes-commit: 225749eb68b3aa3485a1f2dc5d0cafb5dfe53421
2024-03-19 15:16:52 +01:00
Sean Sullivan 5e1f7568bd adds portforward streamtunnel unit tests
Kubernetes-commit: ffafb2b9ca94c14c07fb6c1fc75fccd3aba26f1f
2024-03-06 16:37:17 -08:00
Marek Siarkowicz 13a815b7c8 Serve watch without resourceVersion from cache and introduce a WatchFromStorageWithoutResourceVersion feature gate to allow serving watch from storage.
Kubernetes-commit: 0130072b053f85fb736c24d34552208cdd1bccfe
2024-03-14 15:20:29 +01:00
Marek Siarkowicz 67b6245fc3 Fix enabling consistent list from watch cache also works for resourceVersion=0
Kubernetes-commit: 0b8e79580eb3a63ca7707626b4894adfb9125586
2024-03-04 19:35:34 +01:00
Lukasz Szaszkiewicz b8c7d7868f apiserver/storage/cacher: deflake TestGetListNonRecursiveWithConsistentListFromCache
Kubernetes-commit: c44cc9a575f3bf1248b2fdc8e3a7ba61ab844618
2024-03-14 09:08:29 +01:00
Lukasz Szaszkiewicz a2c5722d64 apiserver/storage/cacher: decrease running time of TestWatchNotHangingOnStartupFailure
before:
go test -v -race -count 1 -run ^TestWatchNotHangingOnStartupFailure$
ok  	k8s.io/apiserver/pkg/storage/cacher	6.775s

after:
go test -v -race -count 1 -run ^TestWatchNotHangingOnStartupFailure$
ok  	k8s.io/apiserver/pkg/storage/cacher	2.781s

Kubernetes-commit: f5d945eb43c7bf8036a4bad8c22448e1146a7498
2024-03-14 08:59:47 +01:00
Lukasz Szaszkiewicz c14671349b apiserver/storage/cacher: decrease of running time of TestWaitUntilWatchCacheFreshAndForceAllEvents
The individual cases can be safely run in parallel.

Before
go test -race  -run TestWaitUntilWatchCacheFreshAndForceAllEvents
ok  	k8s.io/apiserver/pkg/storage/cacher	10.787s

After:
go test -race  -run TestWaitUntilWatchCacheFreshAndForceAllEvents
ok  	k8s.io/apiserver/pkg/storage/cacher	4.857s

Kubernetes-commit: 3ecbb4dee00a5dd1e43e24a5952c2a90ef507ef1
2024-03-12 10:50:44 +01:00
Lukasz Szaszkiewicz 361687d2ad apiserver/storage/cacher: decrease the running time of tests in the cacher package.
It turns out that kube has a custom timeout for tests of 3 minutes.
The tests in the cacher package are utilizing nearly the
entire time and are being terminated, resulting in failing jobs.

Before the change, the TestWatchSemantics took ~43s to run. With this simple change, it now takes ~18s.

When we created the tests, we didn't measure the running time and assumed that waiting 1 second on a watch channel
to make sure no more events are received was sufficient.
This PR decreases the waiting time to 300 milliseconds.
Modern computers can perform many tasks within that time.
In addition to that, the tests are serial in nature, meaning that there is no other
actor that could add items to the database, which could result in receiving new items.

After the change the total running time decreased by 17%.
Before the tests needed ~176s after they need ~146s.
The changes also improved TestWatchSemanticInitialEventsExtended.

Kubernetes-commit: 5a74c8e2202044b664efce4be5d86d700e74506f
2024-03-12 09:15:55 +01:00
Lukasz Szaszkiewicz 80f9ab2a6a apiserver/storage/cacher: decrease of running time of TestEmptyWatchEventCache
updates the test to wait 300 ms instead of 3s
the watch was established otherwise
we would be blocking on a call to cache.Watch(...)
in addition to that, the tests are serial in nature,
meaning that there is no other actor
that could add items to the database,
which could result in receiving new items.

Before:
go test -race  -run TestEmptyWatchEventCache
ok  	k8s.io/apiserver/pkg/storage/cacher	8.450s

After:
go test -race  -run TestEmptyWatchEventCache
ok  	k8s.io/apiserver/pkg/storage/cacher	2.635s

Kubernetes-commit: 926122c035a4f47a880db24d1a0be7ec129dd44d
2024-03-12 13:34:04 +01:00
Marek Siarkowicz 483da2032d Fix non-recursive list when consistent list from cache is enabled
Kubernetes-commit: a527cab9fce0b0234db8b4e1e95a0fc20e135df1
2024-03-04 17:59:04 +01:00
Marek Siarkowicz 3a83dc12eb Fix SetFeatureGateDuringTest handling of Parallel tests
Stop using defer as parallel subtest will might result in main test
finishing before subtest.

Fatal when same flag is set twice.

Kubernetes-commit: 9fcf279e2b91e7549190a433373f256fb5aebe85
2024-03-05 21:56:40 +01:00
Monis Khan aa18faf137 Mark StructuredAuthenticationConfiguration feature gate as beta
Signed-off-by: Monis Khan <mok@microsoft.com>

Kubernetes-commit: bc7aa13bf793148b0c6b3b51fd9a8e17bb412712
2024-03-05 10:39:44 -05:00
Anish Ramasekar ee481149d7 Add metrics for authentication config reload
Signed-off-by: Anish Ramasekar <anish.ramasekar@gmail.com>

Kubernetes-commit: 62ac88b9ea5dace6a61b784f4654fcf379b958e2
2024-03-09 13:29:56 -08:00
Monis Khan 5b4b237d07 Require email_verified to be used when email is set as username via CEL
Signed-off-by: Monis Khan <mok@microsoft.com>

Kubernetes-commit: 121607e80963370c1838f9f620c2b8552041abfc
2024-03-05 17:20:18 -05:00
Anish Ramasekar bc65af8e04 Support multiple JWT authenticators with structured authn config
Signed-off-by: Anish Ramasekar <anish.ramasekar@gmail.com>

Kubernetes-commit: 39e1c9108c0802024ebb01ad2286b2f09f63798e
2024-02-21 15:19:25 -08:00
Anish Ramasekar f09dddfc89 Duplicate v1alpha1 AuthenticationConfiguration to v1beta1
Signed-off-by: Anish Ramasekar <anish.ramasekar@gmail.com>

Kubernetes-commit: b502aa6f31d3f55ce87cafdf3eb5e3fb87e74b50
2024-03-04 23:37:31 -08:00
Tim Allclair 337f031e71 Stop appending AppArmor status to node ready condition
Kubernetes-commit: 24537a91317f9fd125ee805cd0b781358ac86f35
2024-02-21 13:11:07 -08:00
cici37 be9c733e9d Promote ValidatingAdmissionPolicy to GA.
Kubernetes-commit: de506ce7ac9981c8253b2f818478bb4093fb7bb6
2024-01-23 22:10:40 +00:00
Jiahui Feng 8f8266ef89 update to inject only the list of excluded resources.
Kubernetes-commit: 6b03166beda6e550ebcbed1bb7d9ca2cc1d94df4
2024-03-05 10:27:35 -08:00
Jiahui Feng a86b013fb6 make ValidatingAdmissionPolicy ignore excluded resources.
Kubernetes-commit: 64ee859aa82c17daa8037e4e90e066ae4582d653
2024-02-28 15:31:44 -08:00
Jiahui Feng b1e2103ed5 add resource filter to admission initializer.
Kubernetes-commit: 5b1fffa3e40b812e81ede244f671c90e3428e2ec
2024-02-28 15:31:18 -08:00
Monis Khan 37809637af Fix AuthenticationConfiguration docs around nested claims via CEL
Signed-off-by: Monis Khan <mok@microsoft.com>

Kubernetes-commit: 290f2a7e1b62d2bfce2363ec528155a9748e0adb
2024-03-05 12:01:11 -05:00
Lukasz Szaszkiewicz b3f5f43260 storage/cacher: mark the addition of a metric for waitUntilFreshAndBlock as completed
Kubernetes-commit: 221ad9f7c25cc4da36e97c5feca3fc60bbe5bbfa
2024-03-05 10:23:23 +01:00
Monis Khan 9432b4df38 Prevent conflicts between service account and jwt issuers
Signed-off-by: Monis Khan <mok@microsoft.com>

Kubernetes-commit: 05e1eff7933a440595f4bea322b54054d3c1b153
2024-02-27 17:11:18 -05:00
Jordan Liggitt 4d70dec65c Promote StructuredAuthorizationConfiguration feature gate to beta
Kubernetes-commit: 30256c8909ab8c30a64f786361543768f2719c77
2024-03-02 02:12:36 -05:00
Marek Siarkowicz 743b53428c Test that separation of streams work by using progress notifies
Kubernetes-commit: 1cf4cec449cb29718a694e25f4750452af3f491d
2024-02-29 17:51:46 +01:00
Marek Siarkowicz e810084a4b Prevent watch cache starvation, by moving its watch to separate RPC and add a SeparateCacheWatchRPC feature flag to disable this behavior
Kubernetes-commit: 31d404b182d2985ce0d3c43f75d80c29a708beda
2024-02-27 11:25:42 +01:00
Sean Sullivan 0376e5de57 adds comments to tunnelingResponseWriter
Kubernetes-commit: 3d56ff21fd3c9c9da82ff22044691ef0671ac7b6
2024-03-04 11:10:17 -08:00
Jordan Liggitt 9610424488 Fix headerInterceptingConn handling
Kubernetes-commit: 2443b3fa694462ab0438f10dea38557edea4d4e7
2024-03-02 17:57:39 -05:00
Sean Sullivan f4bc37078e portforward: tunnel spdy through websockets
Kubernetes-commit: 8b447d8c97e8823b4308eb91cf7d75693e867c61
2024-02-21 08:56:07 +00:00
Jordan Liggitt 9adb3ee3c0 Add authorization webhook duration/count/failopen metrics
Kubernetes-commit: 79b344d85e3e2f8f3192a3dcabb384cfe87136a6
2024-03-02 01:44:28 -05:00
Sunil Shivanand 9ffd1e2039 Add apiserver_watch_cache_read_wait metric to cache refresh time
Signed-off-by: Sunil Shivanand <padlar@live.com>

Kubernetes-commit: e6ed0f37c65fb22c16f5afa408bc4de166070ebc
2024-02-08 12:39:50 +01:00
xigang 2eff540b7c cleanup: if triggerValue has a value, fast break
Signed-off-by: xigang <wangxigang2014@gmail.com>

Kubernetes-commit: d72448a41c24911a57b24cabdef3ca63ee048bd4
2024-03-04 10:29:31 +08:00
Anish Ramasekar f2c6133c7f Add `DiscoveryURL` to AuthenticationConfiguration
Signed-off-by: Anish Ramasekar <anish.ramasekar@gmail.com>

Kubernetes-commit: 84852ff56f952b4c3daab920d119d24c2e6a3476
2024-02-07 01:41:52 +00:00
Jordan Liggitt 4153027735 Duplicate v1alpha1 AuthorizationConfiguration to v1beta1
Kubernetes-commit: 0605a75c5e3590e2b0ab80d2163a76c4e77f4380
2024-03-02 01:56:29 -05:00
Jordan Liggitt 59cba35b06 Fix discovery v2 conversion registration data race
Kubernetes-commit: 0e9cdf76ad2e21166dd5b72f7b0c2450d648c906
2024-03-01 19:29:39 -05:00
Rita Zhang b7a30e3bfb add authz webhook matchcondition metrics
Signed-off-by: Rita Zhang <rita.z.zhang@gmail.com>
Signed-off-by: Jordan Liggitt <liggitt@google.com>
Co-authored-by: Jordan Liggitt <liggitt@google.com>

Kubernetes-commit: e76fce75666beb2771dfa15a10700f18d2d15d85
2024-02-29 20:55:32 -08:00
Anish Ramasekar 7b0c197f53 cleanup structured authn/authz error logic
Signed-off-by: Anish Ramasekar <anish.ramasekar@gmail.com>

Kubernetes-commit: c2c4f4616d4ecea9fad5b994cdc72e3f96728962
2024-01-25 22:45:19 +00:00
Jefftree d8d3b8c351 Use v2 types with agg discovery
Kubernetes-commit: 462dd326c2e98d937a96d49002883000efe4b2d6
2024-01-19 16:13:47 -05:00
Jefftree 7c8cdebce9 Promote AggregatedDiscovery to GA
Kubernetes-commit: 301e804c3f2fb3935c2cf3d2a04967f47921fc99
2024-02-27 16:59:46 -05:00
Jefftree fc2ef69449 Remove test for disabling aggregated discovery
Kubernetes-commit: 0593746f6093a5a59a7a047f03a4139275fcaf11
2024-02-27 18:27:54 -05:00
Tim Hockin 5624a05672 Remove defunct references to "vendor"
Kubernetes-commit: d772f7719dc55ebfec2e9461b6e14bf17f5301df
2024-01-15 15:56:21 -08:00
Tim Hockin 541bc37de9 Fix go-to-protobuf wrt gengo/v2
There's some very fishy-smelling logic in here, but this commit is
trying to be as focused as possible.

The *.pb.go diffs are the "name" encoded in the descriptor.  The
descriptor blobs can be decoded by this program (thanks StackOverflow!):

```
package main

import (
	"bytes"
	"compress/gzip"
	"encoding/json"
	"fmt"
	"os"

	"io/ioutil"

	proto "github.com/golang/protobuf/proto"
	dpb "github.com/golang/protobuf/protoc-gen-go/descriptor"
)

func main() {
	m := map[string][]byte{
		"before": blobv1,
		"after":  blobv2,
	}
	arg := os.Args[1]
	dump(m[arg])
}

func dump(bytes []byte) {
	fd, err := decodeFileDesc(bytes)
	if err != nil {
		panic(err)
	}
	b, err := json.MarshalIndent(fd, "", "  ")
	if err != nil {
		panic(err)
	}
	fmt.Println(string(b))
}

// decompress does gzip decompression.
func decompress(b []byte) ([]byte, error) {
	r, err := gzip.NewReader(bytes.NewReader(b))
	if err != nil {
		return nil, fmt.Errorf("bad gzipped descriptor: %v", err)
	}
	out, err := ioutil.ReadAll(r)
	if err != nil {
		return nil, fmt.Errorf("bad gzipped descriptor: %v", err)
	}
	return out, nil
}

func decodeFileDesc(enc []byte) (*dpb.FileDescriptorProto, error) {
	raw, err := decompress(enc)
	if err != nil {
		return nil, fmt.Errorf("failed to decompress enc: %v", err)
	}

	fd := new(dpb.FileDescriptorProto)
	if err := proto.Unmarshal(raw, fd); err != nil {
		return nil, fmt.Errorf("bad descriptor: %v", err)
	}
	return fd, nil
}

var blobv1 = []byte{
	// insert proto "before" blob here
}

var blobv2 = []byte{
	// insert proto "after" blob here
}
```

Running this with "before" and "after" args, and diffing the output
yields something like:

```diff
--- /tmp/a	2023-12-23 23:57:04.748090836 -0800
+++ /tmp/b	2023-12-23 23:57:11.000040973 -0800
@@ -1,5 +1,5 @@
 {
-  "name": "k8s.io/kubernetes/vendor/k8s.io/api/admission/v1/generated.proto",
+  "name": "k8s.io/api/admission/v1/generated.proto",
   "package": "k8s.io.api.admission.v1",
   "dependency": [
     "github.com/gogo/protobuf/gogoproto/gogo.proto",
```

Kubernetes-commit: b0a70dec4ab4cb9f972cf39a81ca5e5555417227
2023-12-24 10:01:42 -08:00
Igor Velichkovich fc7cf5fb84 kep-3716 GA, remove feature gate
Kubernetes-commit: a51a5b462236d5eb87e6d690065f884c281a833c
2024-02-28 10:45:51 -06:00
Anish Ramasekar b3e4dc29ef add min valid jwt payload to API docs for structured authn config
Signed-off-by: Anish Ramasekar <anish.ramasekar@gmail.com>

Kubernetes-commit: b57d7d6ad79ed0a2a8359144c07eadeef0ea3fd3
2024-02-22 16:33:24 -08:00
Lukasz Szaszkiewicz 816c9a3d12 apiserver/storage: improve RunWatchSemanticInitialEventsExtended test
changes the test to populate the underlying data store with
more data to trigger potential ordering issues.

Kubernetes-commit: 20ded275705a6e11c1113cbeedad4de94e2dc666
2024-01-10 11:08:35 +01:00
Joe Betz 414d2e2d63 Add selectableFields to CRDs
Kubernetes-commit: 291703482d58ae030da71c6d671a96a6f960fc6f
2024-02-28 14:06:06 -05:00
Wojciech Tyczyński 45b7f21179 Ensure that initial events are sorted for WatchList
Kubernetes-commit: 92bdc7b3873800e6130176e49acdf5e17110e5b9
2023-09-26 18:39:44 +02:00
Lukasz Szaszkiewicz e53bac21d8 storage/watch_cache: rework getAllEventsSinceLocked
Kubernetes-commit: ecaf2093f51fed5f544520b0ac00fb33a474b7f5
2024-02-26 12:22:05 +01:00
Lukasz Szaszkiewicz 19bd56380e storage/cacher: add TestGetWatchCacheResourceVersion, TestGetBookmarkAfterResourceVersionLockedFunc
Kubernetes-commit: d629d3fa355ec90f618663b0933d28d335489c54
2024-02-21 10:06:42 +01:00